new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

csrf/form_requests

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Simple form requests vulnerable to CSRF

Form submissions using <form> tags send 'simple' requests that browsers do not preflight. Simple requests are vulnerable to CSRF because browsers permit them to be sent to any origin. A request is simple if it has one of these content types: application/x-www-form-urlencoded, multipart/form-data, or text/plain. If application uses <form> tags, protect with alternate CSRF approaches like CSRF tokens even though custom headers are not required.

Disallow simple content types for state-changing requests

Simple mitigation for form-based CSRF: disable simple content types on server or API. Many modern web applications use JSON APIs that require CORS preflight, but some may accept text/plain which is vulnerable to CSRF. By rejecting application/x-www-form-urlencoded, multipart/form-data, and text/plain on state-changing endpoints, you force clients to use content types (like application/json) that require CORS preflight, which blocks simple cross-site form submissions.

Give your agent this brain